Software licensing information is the big use case where SPDX originated from. In CycloneDX you can also express things like attestations/certifications, possi

Software licensing information is the big use case where SPDX originated from. In CycloneDX you can also express things like attestations/certifications, possibly down to the code review level (although I think nobody does that).